Inactive Freezing or turning off at start-up

PamMac · 2011/06/27

OTL logfile created on: 6/27/2011 3:45:57 PM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Pammy\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 2.16 Gb Available Physical Memory | 71.97% Memory free
6.00 Gb Paging File | 5.10 Gb Available in Paging File | 85.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.29 Gb Total Space | 71.52 Gb Free Space | 50.26% Space Free | Partition Type: NTFS
Drive D: | 149.05 Gb Total Space | 58.16 Gb Free Space | 39.02% Space Free | Partition Type: NTFS
Drive F: | 23.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: PAMMY-PC | User Name: Pammy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/27 15:26:49 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Pammy\Downloads\OTL.exe
PRC - [2011/05/29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/05/16 05:53:20 | 000,325,512 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2011/05/04 05:46:33 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/03/20 06:01:47 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/02/25 15:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2010/11/20 22:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/11/20 22:17:00 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2010/11/11 12:13:19 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/06/01 10:17:48 | 005,252,408 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2010/05/08 16:46:00 | 000,110,592 | ---- | M] () -- C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/08/18 02:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

========== Modules (SafeList) ==========

MOD - [2011/06/27 15:26:49 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Pammy\Downloads\OTL.exe
MOD - [2010/11/20 21:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2011/05/29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/05/04 05:46:33 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/03/20 06:01:47 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/02/28 17:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/06/14 14:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/05/10 20:46:41 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/07/14 11:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 11:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 11:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/17 14:36:12 | 000,144,752 | ---- | M] (TOSHIBA CORPORATION) [Disabled | Stopped] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2008/11/10 06:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

========== Driver Services (SafeList) ==========

DRV - [2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/03/20 06:01:49 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/12/03 06:21:08 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/20 22:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 22:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 22:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 20:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 20:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 19:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 19:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 19:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/03/25 09:08:38 | 000,105,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010/03/24 12:57:44 | 000,204,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010/03/20 10:56:04 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2010/02/26 13:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010/02/26 13:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010/02/26 13:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010/02/26 13:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009/08/18 03:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/07/14 09:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\serial.sys -- (Serial)
DRV - [2009/07/14 08:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/07/14 08:02:53 | 000,311,296 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 08:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/23 17:28:24 | 000,054,272 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2009/03/19 14:07:32 | 000,043,264 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2009/03/12 11:33:08 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2009/03/05 11:03:16 | 000,074,368 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2009/03/03 15:42:56 | 000,036,864 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2009/02/19 16:20:10 | 000,063,872 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2008/10/06 17:56:38 | 000,137,984 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/08/26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/03/25 13:54:02 | 000,041,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2007/11/09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2006/10/23 16:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)
DRV - [1999/09/10 12:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKU\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 54 93 73 98 7C EE CA 01 [binary data]
IE - HKU\S-1-5-21-938479277-490932668-5583128-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AOL Search "
FF - prefs.js..browser.search.defaulturl: "http://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolTB50CL-chromesbox-en-us "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.selectedEngine: "Google "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ "
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.3.2
FF - prefs.js..extensions.enabledItems: player@portalarium.com:1.36
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties "

FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/10/16 13:34:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/24 22:09:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/24 22:09:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/10/16 13:34:43 | 000,000,000 | ---D | M]

[2010/05/08 17:32:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pammy\AppData\Roaming\Mozilla\Extensions
[2011/05/24 13:21:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions
[2011/05/09 12:35:59 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/05/24 13:21:46 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/05/08 19:06:20 | 000,000,000 | ---D | M] (Portalarium Player) -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\player@portalarium.com
[2010/09/17 15:08:52 | 000,002,277 | ---- | M] () -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\searchplugins\aol-search.xml
[2010/05/09 07:13:41 | 000,001,819 | ---- | M] () -- C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\searchplugins\bing.xml
[2011/05/08 20:28:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/04/15 02:41:09 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 18:00:00 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/01/01 18:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 18:00:00 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 18:00:00 | 000,001,180 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 18:00:00 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/11 07:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-938479277-490932668-5583128-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKU\S-1-5-21-938479277-490932668-5583128-1000\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2008/09/03 10:07:56 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/27 12:23:14 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/06/27 12:22:09 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/06/27 12:15:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/06/27 12:15:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/06/27 12:15:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/06/27 12:15:05 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/06/27 10:36:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/06/24 22:14:42 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\My Slide Shows
[2011/06/24 22:09:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2011/06/24 22:09:12 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/06/24 17:29:11 | 000,000,000 | R--D | C] -- C:\Users\Pammy\Searches
[2011/06/24 12:41:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SIW
[2011/06/24 12:41:46 | 000,000,000 | ---D | C] -- C:\Program Files\SIW
[2011/06/21 15:15:45 | 000,000,000 | ---D | C] -- C:\Users\Pammy\Documents\Bluetooth
[2011/06/21 15:15:20 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\Toshiba
[2011/06/21 15:15:20 | 000,000,000 | ---D | C] -- C:\ProgramData\TOSHIBA
[2011/06/20 16:02:03 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\Microsoft Games
[2011/06/20 15:55:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TOSHIBA
[2011/06/20 15:55:19 | 000,000,000 | ---D | C] -- C:\Program Files\Toshiba
[2011/06/20 15:55:11 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Roaming\WinBatch
[2011/06/20 07:34:06 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011/06/20 07:32:38 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011/06/20 07:28:39 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\fms.dll
[2011/06/05 14:43:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/06/05 14:43:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/06/05 12:49:19 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Roaming\Malwarebytes
[2011/06/05 12:49:13 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/06/05 12:49:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/05 12:49:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/06/05 12:49:09 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/06/05 12:49:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/02 12:46:19 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Roaming\WinPatrol
[2011/06/02 12:46:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
[2011/06/02 12:46:07 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2011/06/02 12:46:07 | 000,000,000 | ---D | C] -- C:\Program Files\BillP Studios
[2011/06/02 06:48:57 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/06/02 06:47:30 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\Google
[2011/06/02 06:37:43 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{AB3C9AC3-9114-422E-B358-453FED6C48E2}
[2011/06/02 06:20:10 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{BFBCDB57-D875-4651-814E-680AB403C0C7}
[2011/06/01 06:00:54 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{312AFF39-07B8-4E0A-9505-1BD311B2858C}
[2011/05/31 12:26:55 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{D02C1646-034F-4402-988B-62F68B182858}
[2011/05/31 06:07:58 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{6D7E3554-0B02-4FF3-B6AA-3669F47386C9}
[2011/05/30 05:47:28 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{98EF25DA-56A2-426F-9C3A-FB9E6F6DC919}
[2011/05/29 06:55:25 | 000,000,000 | ---D | C] -- C:\Users\Pammy\AppData\Local\{137CE30C-53A0-4A8E-9489-1DA08A9CA529}

========== Files - Modified Within 30 Days ==========

[2011/06/27 14:57:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-938479277-490932668-5583128-1000UA.job
[2011/06/27 12:34:20 | 000,021,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/27 12:34:20 | 000,021,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/27 12:33:35 | 000,628,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/06/27 12:33:35 | 000,110,612 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/06/27 12:26:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/27 12:26:41 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/26 15:00:44 | 000,001,095 | ---- | M] () -- C:\Users\Pammy\Desktop\tdsskiller - Shortcut.lnk
[2011/06/26 08:15:57 | 463,965,337 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/06/26 07:57:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-938479277-490932668-5583128-1000Core.job
[2011/06/25 14:01:00 | 000,001,048 | ---- | M] () -- C:\Users\Pammy\Desktop\dds - Shortcut.lnk
[2011/06/25 14:00:42 | 000,001,075 | ---- | M] () -- C:\Users\Pammy\Desktop\aswMBR - Shortcut.lnk
[2011/06/24 20:24:31 | 000,001,908 | ---- | M] () -- C:\Windows\diagwrn.xml
[2011/06/24 20:24:31 | 000,001,908 | ---- | M] () -- C:\Windows\diagerr.xml
[2011/06/24 20:24:12 | 000,003,132 | ---- | M] () -- C:\Users\Pammy\Desktop\Windows Compatibility Report.htm
[2011/06/24 12:41:48 | 000,000,856 | ---- | M] () -- C:\Users\Pammy\Desktop\SIW.lnk
[2011/06/22 10:09:42 | 000,007,599 | ---- | M] () -- C:\Users\Pammy\AppData\Local\Resmon.ResmonCfg
[2011/06/20 08:00:53 | 000,001,370 | ---- | M] () -- C:\Users\Pammy\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/20 07:53:08 | 000,266,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/06/20 07:44:42 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011/06/15 11:57:51 | 000,002,362 | ---- | M] () -- C:\Users\Pammy\Desktop\Google Chrome.lnk
[2011/06/05 14:47:54 | 000,184,060 | ---- | M] () -- C:\Users\Public\Documents\cc_20110605_144741.reg
[2011/06/05 14:43:55 | 000,000,928 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/06/05 12:49:13 | 000,001,030 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2011/06/27 12:15:08 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/06/27 12:15:08 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/06/27 12:15:08 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/06/27 12:15:08 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/06/27 12:15:08 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/06/26 15:00:44 | 000,001,095 | ---- | C] () -- C:\Users\Pammy\Desktop\tdsskiller - Shortcut.lnk
[2011/06/26 08:15:57 | 463,965,337 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/06/25 14:01:00 | 000,001,048 | ---- | C] () -- C:\Users\Pammy\Desktop\dds - Shortcut.lnk
[2011/06/25 14:00:42 | 000,001,075 | ---- | C] () -- C:\Users\Pammy\Desktop\aswMBR - Shortcut.lnk
[2011/06/24 20:24:12 | 000,003,132 | ---- | C] () -- C:\Users\Pammy\Desktop\Windows Compatibility Report.htm
[2011/06/24 20:16:53 | 000,001,908 | ---- | C] () -- C:\Windows\diagwrn.xml
[2011/06/24 20:16:53 | 000,001,908 | ---- | C] () -- C:\Windows\diagerr.xml
[2011/06/24 12:41:48 | 000,000,856 | ---- | C] () -- C:\Users\Pammy\Desktop\SIW.lnk
[2011/06/20 09:52:17 | 000,007,599 | ---- | C] () -- C:\Users\Pammy\AppData\Local\Resmon.ResmonCfg
[2011/06/20 07:44:42 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011/06/20 07:29:51 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011/06/20 07:29:39 | 000,146,852 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2011/06/20 07:28:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011/06/20 07:28:23 | 000,010,429 | ---- | C] () -- C:\Windows\System32\ScavengeSpace.xml
[2011/06/20 07:28:13 | 000,105,559 | ---- | C] () -- C:\Windows\System32\RacRules.xml
[2011/06/05 14:47:46 | 000,184,060 | ---- | C] () -- C:\Users\Public\Documents\cc_20110605_144741.reg
[2011/06/05 14:43:55 | 000,000,928 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/06/05 12:49:13 | 000,001,030 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 06:49:00 | 000,002,362 | ---- | C] () -- C:\Users\Pammy\Desktop\Google Chrome.lnk
[2011/06/02 06:47:35 | 000,000,908 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-938479277-490932668-5583128-1000UA.job
[2011/06/02 06:47:34 | 000,000,856 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-938479277-490932668-5583128-1000Core.job
[2010/10/16 13:48:46 | 000,013,312 | ---- | C] () -- C:\Users\Pammy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/17 17:29:09 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini
[2010/09/17 14:43:17 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/05/09 09:09:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 14:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 14:33:53 | 000,266,808 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 12:05:48 | 000,628,460 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/14 12:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/14 12:05:48 | 000,110,612 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/14 12:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/14 12:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/14 12:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/14 09:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 09:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 09:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/18 19:29:04 | 000,197,654 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009/06/11 07:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/02/18 17:55:22 | 000,294,912 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2009/02/03 20:52:04 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe

========== LOP Check ==========

[2010/05/28 19:43:33 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\Facebook
[2011/04/23 17:21:47 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\KEDDS
[2010/10/16 13:36:50 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\Nokia
[2010/10/16 13:46:17 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\PC Suite
[2011/04/23 15:44:24 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\Skinux
[2011/06/20 15:55:11 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\WinBatch
[2011/06/02 12:46:19 | 000,000,000 | ---D | M] -- C:\Users\Pammy\AppData\Roaming\WinPatrol
[2011/04/26 06:44:08 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/11 07:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2010/11/20 22:40:07 | 000,383,786 | RHS- | M] () -- C:\bootmgr
[2010/05/09 10:03:47 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/06/27 12:23:13 | 000,012,559 | ---- | M] () -- C:\ComboFix.txt
[2009/06/11 07:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/06/27 12:26:41 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys
[2007/05/29 08:27:23 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2007/05/29 08:27:23 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/06/27 12:26:43 | 3219,578,880 | -HS- | M] () -- C:\pagefile.sys
[2010/04/20 16:42:54 | 000,035,519 | ---- | M] () -- C:\SoftUpdateLog.txt
[2011/06/26 15:07:13 | 000,069,826 | ---- | M] () -- C:\TDSSKiller.2.5.5.0_26.06.2011_15.01.54_log.txt
[2008/03/17 09:04:34 | 000,000,158 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 14:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 14:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 14:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 14:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 07:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 11:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 22:21:36 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 01:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 14:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/06/20 08:00:53 | 000,000,221 | -HS- | M] () -- C:\Users\Pammy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/11 07:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/06/20 08:00:52 | 000,000,402 | -HS- | M] () -- C:\Users\Pammy\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1999/09/10 12:06:00 | 000,004,672 | ---- | M] (Adaptec) -- C:\Windows\system\WOWPOST.EXE

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6971CCC5

< End of report >

PamMac · 2011/06/27

OTL Extras logfile created on: 6/27/2011 3:45:57 PM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Pammy\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 2.16 Gb Available Physical Memory | 71.97% Memory free
6.00 Gb Paging File | 5.10 Gb Available in Paging File | 85.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.29 Gb Total Space | 71.52 Gb Free Space | 50.26% Space Free | Partition Type: NTFS
Drive D: | 149.05 Gb Total Space | 58.16 Gb Free Space | 39.02% Space Free | Partition Type: NTFS
Drive F: | 23.31 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: PAMMY-PC | User Name: Pammy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{749A1EDD-16C2-4C63-B013-D38F0F953973}" = OviMPlatform
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{8112C6B3-91E1-4560-8AB9-876DADFA37C5}" = Ovi Desktop Sync Engine
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2011.05.26
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B8B4446F-87E1-4423-A47A-16832C24A199}" = Nokia Ovi Suite
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE5B5B24-EEFC-4C8B-BF8B-256D705BAD89}" = Nokia Ovi Suite Software Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"3 MobileBroadband" = 3 MobileBroadband
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CameraUserGuide-PSA480" = Canon PowerShot A480 Camera User Guide
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CCleaner" = CCleaner
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 4.0.1 (x86 en-GB)" = Mozilla Firefox 4.0.1 (x86 en-GB)
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"Nokia Ovi Suite" = Nokia Ovi Suite
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"pocketwifi" = pocketwifi
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"SoftwareStarterGuide-DCSD40_46" = Canon Digital Camera Solution Disk 40-46 Software Starter Guide
"ViewpointMediaPlayer" = Viewpoint Media Player
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Software Update" = Yahoo! Software Update
"Yahoo!7 Messenger" = Yahoo!7 Messenger
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.7.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/24/2011 8:18:01 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/24/2011 8:18:01 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/24/2011 6:13:09 PM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:00:08 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:00:20 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:14:30 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:14:37 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:14:40 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 5:45:40 AM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

Error - 6/26/2011 9:18:34 PM | Computer Name = Pammy-PC | Source = VSS | ID = 8193
Description =

[ System Events ]
Error - 6/26/2011 8:37:26 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 8:40:20 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 8:42:26 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 9:21:33 PM | Computer Name = Pammy-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 6/26/2011 9:21:33 PM | Computer Name = Pammy-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 6/26/2011 10:15:35 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 10:18:47 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 10:21:04 PM | Computer Name = Pammy-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 6/26/2011 10:26:47 PM | Computer Name = Pammy-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 6/26/2011 10:26:47 PM | Computer Name = Pammy-PC | Source = atikmdag | ID = 43029
Description = Display is not active

< End of report >

broni · 2011/06/27

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O15 - HKU\S-1-5-21-938479277-490932668-5583128-1000\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6971CCC5

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
===================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

PamMac · 2011/06/27

All processes killed
========== OTL ==========
Service ACDaemon stopped successfully!
Service ACDaemon deleted successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_USERS\S-1-5-21-938479277-490932668-5583128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
ADS C:\ProgramData\TEMP:6971CCC5 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pammy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 858344 bytes
->FireFox cache emptied: 48227035 bytes
->Google Chrome cache emptied: 159401546 bytes
->Flash cache emptied: 2282 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 199.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Pammy
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.24.1 log created on 06282011_090412

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

PamMac · 2011/06/27

Results of screen317's Security Check version 0.99.7
Windows 7 Service Pack 1 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Adobe Flash Player 10.3.181.22
Adobe Reader 9.4.4
Out of date Adobe Reader installed!
Mozilla Firefox (x86 en-GB..) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
WinPatrol winpatrol.exe
Malwarebytes' Anti-Malware mbamservice.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
BillP Studios WinPatrol WinPatrol.exe
``````````End of Log````````````

broni · 2011/06/27

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

...and Eset...

PamMac · 2011/06/27

Had the same problems at start-up this morning.
I've run TFC & was running ESET. Laptop switched itself off while scanning. Re-started it & uninstalled Adobe. Downloaded Foxit but not installed it yet.
Going to try running ESET again now

broni · 2011/06/27

OK. You may some other issues as well....

PamMac · 2011/06/27

Two hours into the scan (it had completed about 45%, no threats found at that stage)) laptop again switched off.
Will I keep trying?

broni · 2011/06/27

This one should be much faster...

Please run a BitDefender Online Scan

Disable your antivirus program.

Click Start Scanner button.

Click Free scan now button

Allow browser plug-in to be installed when prompted.

Click I Agree to agree to the EULA.

Please refrain from using the computer until the scan is finished.

When the scan is finished, click on View report.

Notepad will open with scan results.

Save the report to your desktop and post its content in your next reply.

PamMac · 2011/06/27

QuickScan Beta 32-bit v0.9.9.97
-------------------------------
Scan date: Tue Jun 28 13:07:31 2011
Machine ID: A8460039

No infection found.
-------------------

Processes
---------
WinPatrol Monitor 1344 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
3 MobileBroadband.exe 2708 C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe
AntiVir Desktop 1856 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
Google Chrome 1572 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 2092 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 3004 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 3068 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 3992 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
Microsoft® Windows® Operating System 1528 C:\Windows\explorer.exe
Microsoft® Windows® Operating System 2640 C:\Windows\System32\rundll32.exe
Microsoft® Windows® Operating System 632 C:\Windows\System32\taskhost.exe
Yahoo! Messenger 1308 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
(verified) Microsoft® Windows® Operating System 1512 C:\Windows\System32\dwm.exe

Network activity
----------------
Process YahooMessenger.exe (1308) connected on port 80 (HTTP) --> 98.136.48.75
Process YahooMessenger.exe (1308) connected on port 80 (HTTP) --> 98.137.130.80
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.72
Process chrome.exe (3992) connected on port 80 (HTTP) --> 125.56.253.229
Process chrome.exe (3992) connected on port 80 (HTTP) --> 125.56.204.50
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.90
Process chrome.exe (3992) connected on port 443 (HTTP over SSL) --> 74.125.71.95
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 443 (HTTP over SSL) --> 74.125.71.96
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.71.96
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.81
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.84
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.74
Process chrome.exe (3992) connected on port 80 (HTTP) --> 74.125.237.74
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 69.171.224.12
Process chrome.exe (3992) connected on port 80 (HTTP) --> 69.171.224.12
Process chrome.exe (3992) connected on port 80 (HTTP) --> 69.171.224.12
Process chrome.exe (3992) connected on port 80 (HTTP) --> 69.171.224.12
Process chrome.exe (3992) connected on port 80 (HTTP) --> 69.171.224.12
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 210.9.88.43
Process chrome.exe (3992) connected on port 80 (HTTP) --> 210.9.88.106
Process chrome.exe (3992) connected on port 80 (HTTP) --> 210.9.88.106
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.16
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 203.171.195.10
Process chrome.exe (3992) connected on port 80 (HTTP) --> 66.220.145.44
Process chrome.exe (3992) connected on port 80 (HTTP) --> 66.220.145.44
Process chrome.exe (3992) connected on port 80 (HTTP) --> 91.199.104.31
Process chrome.exe (3992) connected on port 443 (HTTP over SSL) --> 74.125.237.71
Process chrome.exe (3992) connected on port 443 (HTTP over SSL) --> 74.125.71.132
Process chrome.exe (3992) connected on port 80 (HTTP) --> 66.235.143.118

Process YahooMessenger.exe (1308) listens on ports: 5101 (Yahoo Messenger)

Autoruns and critical files
---------------------------
WinPatrol Monitor C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
AntiVir Desktop C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
Microsoft® Windows® Operating System C:\Windows\system32\Bubbles.scr
Microsoft® Windows® Operating System c:\windows\system32\userinit.exe
Windows® Internet Explorer c:\windows\system32\webcheck.dll
(verified) Google Update C:\Users\Pammy\AppData\Local\Google\Update\GoogleUpdate.exe

Browser plugins
---------------
BitDefender QuickScan C:\Users\Pammy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.97_0\npqscan.dll
BrowserPlus (from Yahoo!) v2.7.1 C:\Users\Pammy\AppData\Local\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll
Facebook Plugin C:\Users\Pammy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
Google Update C:\Users\Pammy\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
MetaStream 3 Plugin C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
Microsoft® CoReXT c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
Microsoft® CoReXT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
Microsoft® Windows® Operating System C:\Windows\system32\mswsock.dll
Microsoft® Windows® Operating System C:\Windows\System32\nlaapi.dll
NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll
Portalarium Player C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\player@portalarium.com\plugins\NPPortalariumPlayer.dll
RadioWMPCore.dll C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
Silverlight Plug-In C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
TODO: <Product name> C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll
Windows Live Messenger Companion c:\program files\windows live\companion\companioncore.dll
Windows Liveâ„¢ Photo Gallery C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
Windows® Internet Explorer C:\Windows\system32\ieframe.dll
Yahoo Application State Plugin C:\Program Files\Yahoo!\Shared\npYState.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll
(verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll
(verified) RadioWMPCoreGecko19.dll C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko19.dll

Missing files
-------------
File not found: "c:\program files\microsoft\bingbar\bingext.dll "
--> HKLM\Software\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\InprocServer32\ "(default) "
--> HKLM\Software\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\InprocServer32\ "(default) "

Scan
----
MD5: e7c4b8feb68e8f2759213b3c889b7349 C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe
MD5: 3f309a75b44fb50035f837f55350ebd6 C:\Program Files\3 MobileBroadband\AddrBookUIPlugin.dll
MD5: 231c7b7b025438a853fd7df93a184d9d C:\Program Files\3 MobileBroadband\atcomm.dll
MD5: d326130f4310ca85f89bb1e0469b9def C:\Program Files\3 MobileBroadband\ConfigFilePlugin.dll
MD5: e740950c578d8873b0aecef98a9ec53a C:\Program Files\3 MobileBroadband\Container.dll
MD5: 02ac440ac21ff76a6b341079aac9c7f0 C:\Program Files\3 MobileBroadband\DetectDev.dll
MD5: 8d66d1cdb630444e742f33bafd0211a7 C:\Program Files\3 MobileBroadband\DeviceMgrPlugin.dll
MD5: 8e52bd8780bc83a1c8021ddd0c0fd2e8 C:\Program Files\3 MobileBroadband\DeviceMgrUIPlugin.dll
MD5: 9ad94d195117f4310d41e3123c29c0a4 C:\Program Files\3 MobileBroadband\DeviceOperate.dll
MD5: 0879af42431c1e10d180f9fef77d4a5d C:\Program Files\3 MobileBroadband\DialUpPlugin.dll
MD5: 5a478805aabaf85631de9f462e1529d9 C:\Program Files\3 MobileBroadband\DialupUIPlugin.dll
MD5: 8636338523933065e547d2c648ae339d C:\Program Files\3 MobileBroadband\FileManager.dll
MD5: 28a5dc01992d01a2006fd72b869e2691 C:\Program Files\3 MobileBroadband\isaputrace.dll
MD5: c6da5c0d04a003e465dd83c8896726c7 C:\Program Files\3 MobileBroadband\LayoutPlugin.dll
MD5: 9f93abe47860c286c54a45eaa1ec40c5 C:\Program Files\3 MobileBroadband\LocaleMgrPlugin.dll
MD5: 0585d4c39d70db7586aa0dbcfc29df9b C:\Program Files\3 MobileBroadband\MenuMgrPlugin.dll
MD5: c882b8e8882f4681caf2c38b02287d40 C:\Program Files\3 MobileBroadband\NetConnectPlugin.dll
MD5: a69ca24edfab7b18e4a02d0ade28b3a0 C:\Program Files\3 MobileBroadband\NetInfoPlugin.dll
MD5: 198ffcfff24b3e5176a820349d54b1a8 C:\Program Files\3 MobileBroadband\NetInfoUIExPlugin.dll
MD5: e3fa4604658c484b638bcf9bdd3edf18 C:\Program Files\3 MobileBroadband\NotifyServicePlugin.dll
MD5: 7413da8202f557fcc49f26a7b60956d7 C:\Program Files\3 MobileBroadband\SkinMagicExU.dll
MD5: 08d373921ff680b5aae59e6f0814d987 C:\Program Files\3 MobileBroadband\SkinMagicU.dll
MD5: 545fc4feeb6100c7bd696c4603129be2 C:\Program Files\3 MobileBroadband\SMSPlugin.dll
MD5: de962da6093a4f605e49c10575c9a8a0 C:\Program Files\3 MobileBroadband\SMSUIPlugin.dll
MD5: dd2dceeb3f1a2b2bdb5427338e246b94 C:\Program Files\3 MobileBroadband\StatusBarMgrPlugin.dll
MD5: 782221707c2fe5ff722ebe05f93dd6fc C:\Program Files\3 MobileBroadband\ToolBarMgrPlugin.dll
MD5: 8759debb36a41f82bb3ed9d250797e65 C:\Program Files\3 MobileBroadband\TracePlugin.dll
MD5: efc83deb590b7bd5c64f85a0f00d15c0 C:\Program Files\3 MobileBroadband\XCodec.dll
MD5: 37bd3fe81823c06b9daf5aaebc67eef7 C:\Program Files\3 MobileBroadband\XFramePlugin.dll
MD5: c983e62b6fb74457d173ba93f66f6068 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
MD5: b4016c02d0d422d7bbf5b4b1ace14a15 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
MD5: bf1e084c7907b6ed52c26f847e3b725b c:\program files\avira\antivir desktop\ccgen.dll
MD5: f05a5753c308425749b37acd39a5f760 c:\program files\avira\antivir desktop\ccgenrc.dll
MD5: e65e277c50bd5967b5e92c7744dba7bc c:\program files\avira\antivir desktop\ccguard.dll
MD5: 54ceee9d7aa46f3311d247bf57bbee36 c:\program files\avira\antivir desktop\cclic.dll
MD5: 400ab97179f05ba68b755d8971f262f2 c:\program files\avira\antivir desktop\ccmsg.dll
MD5: 7d541c5e5cdfb46d68ac60012c5d7acd c:\program files\avira\antivir desktop\ccupdate.dll
MD5: a93a23d1d8922fe1e625d9884c275ff5 c:\program files\avira\antivir desktop\ccupdrc.dll
MD5: 47766f6b79a25af04ed3f6f2b02aa4cb C:\Program Files\Avira\AntiVir Desktop\ccwkrlib.dll
MD5: 7464c6694036b42ba237eb723a34d0f4 C:\Program Files\Avira\AntiVir Desktop\rcimage.dll
MD5: b4837fe56d76b2e9ea90e5365cf6a2be C:\Program Files\Avira\AntiVir Desktop\sched.exe
MD5: b7b5c8312516528b8bb3f1cdc635f122 C:\Program Files\BillP Studios\WinPatrol\PATROLPRO.DLL
MD5: 45c045c6813e17639e8d86469fd1c759 C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll
MD5: c0992aa77c76fb4ca429cd2c046662f5 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
MD5: 6bf01e200063d7274f3af06d226671f5 c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
MD5: 9d4a1690af93f233e15380398bec7431 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
MD5: 0a70f4022ec2e14c159efc4f69aa2477 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
MD5: a1659e4d08fe8d0f0bc61960d8c0369e C:\Program Files\Internet Explorer\ieproxy.dll
MD5: ec60491a5ff57700f10fe0403f7dcad4 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
MD5: c3e42cbf8215171a524d123a54ae3233 C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
MD5: 825f81a6f7dd073509db101f0ba6dc59 C:\Program Files\Microsoft\BingBar\BBSvc.EXE
MD5: cc781378e7eda615d2cdca3b17829fa4 C:\Program Files\Microsoft\BingBar\SeaPort.EXE
MD5: 2d841b7b7f6dec32162edfcc69d61f42 C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
MD5: e44759cb4ac9f43464d8780501cc0470 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
MD5: bcdff548f7d31a2bcf1cf98da7eb5445 C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
MD5: 47bdbce3e2d819b17ab9fa4539b9df71 c:\program files\windows live\companion\companioncore.dll
MD5: 4ce9dac1518ff7e77bd213e6394b9d77 C:\Program Files\Windows Live\Family Safety\fsssvc.exe
MD5: 6067acef367e79914af628fa1e9b5330 C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
MD5: ac421a44de902f2627f1e63793ed89cd C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
MD5: 3b40d3a61aa8c21b88ae57c58ab3122e C:\Program Files\Windows Media Player\wmpnetwk.exe
MD5: 92b404ba9a60550dc6b6a00cdf324ad9 C:\Program Files\Yahoo!\Messenger\ConnectionWizard.dll
MD5: ff75659cbc7965c926c12c030443b3b4 C:\Program Files\Yahoo!\Messenger\core_video.dll
MD5: 83e1bd5947fed0b9f2bfc7836e3bb8ac C:\Program Files\Yahoo!\Messenger\ft60.dll
MD5: 3220206475b06008e8c2a1476ee3c1be C:\Program Files\Yahoo!\Messenger\nspr4.dll
MD5: 1494c1aa659904c3b8c6b280a5823c00 C:\Program Files\Yahoo!\Messenger\resources\en-AU\res_msgr.dll
MD5: e94fea490728ccee37fd5168982d4a84 C:\Program Files\Yahoo!\Messenger\RGX.dll
MD5: 525137cac21fcf94e5e2778e9335b40a C:\Program Files\Yahoo!\Messenger\rmc_audio.dll
MD5: 2682ca3309cd35622f2831d772e12b0c C:\Program Files\Yahoo!\Messenger\rmc_video.dll
MD5: 1215326c3f11ed9874de189f12d58aa6 C:\Program Files\Yahoo!\Messenger\YAlertCenterM.DLL
MD5: ccb32aeeea47c89cdf072a1253091dcc C:\Program Files\Yahoo!\Messenger\YCPFoundation.dll
MD5: e63a7aabb533d0baf69b2e2234864e4c C:\Program Files\Yahoo!\Messenger\YCPSSL.dll
MD5: 971c7067694cab9486a3860fd19f7f87 C:\Program Files\Yahoo!\Messenger\YHTTP.dll
MD5: e166b98de88e207e2f0cef8bdcf0cd73 C:\Program Files\Yahoo!\Messenger\YImage.dll
MD5: 00d61435683a805a861d75d07b5a4783 C:\Program Files\Yahoo!\Messenger\YIniDom.dll
MD5: 39da9b01e6a88eec314137dded6cc288 C:\Program Files\Yahoo!\Messenger\ylog.dll
MD5: 05d9c84f8d236adaa0372e4b74afc9cb C:\Program Files\Yahoo!\Messenger\ymdm_audio.dll
MD5: 3963e5ffe9d20bdb9458e8511c85da1e C:\Program Files\Yahoo!\Messenger\ymdm_video.dll
MD5: 3cc7926a5f9fa6d919023b088b5c628c C:\Program Files\Yahoo!\Messenger\Yml.dll
MD5: 79e431ea8da670d4dbff9deea8df35dd C:\Program Files\Yahoo!\Messenger\ymsdk.dll
MD5: 7ae55dfd1bbcf8a6c6ddb2e92a5be5f8 C:\Program Files\Yahoo!\Messenger\ymsglite.dll
MD5: 26a3565ba2db42aa101333b629064620 C:\Program Files\Yahoo!\Messenger\ypagerps1.DLL
MD5: 01bb6793d8f7b1f23840082604d2e748 C:\Program Files\Yahoo!\Messenger\YPluginRegistry.dll
MD5: a3981755fbf4ca6ed591e716855ed58f C:\Program Files\Yahoo!\Messenger\yui.dll
MD5: 178c1c9dcd101e98fa82e51d311b8b3d C:\Program Files\Yahoo!\Shared\npYState.dll
MD5: 9feaa026e2e4bdf91878a34bb8e3d957 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\avcodec-52.dll
MD5: c6a9382ec5b3681be15bca9009f70c23 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\avformat-52.dll
MD5: 2a9d613547dc5b0e12a9e1f01b019a5f C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\avutil-50.dll
MD5: 7e344516ad1fea6ab2186798011b916b C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\chrome.dll
MD5: 2c854ad1bfd6d30b0623ff7ee79d1273 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\gcswf32.dll
MD5: d16c6558e4784b5906f5e87059982c95 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\icudt.dll
MD5: f3cd5c531e37a80bf8669958b9d97f50 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\pdf.dll
MD5: 78b4346ac159906ea2eeb3dd799c8492 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\12.0.742.100\ppGoogleNaClPluginChrome.dll
MD5: bfbf37f9f55c35ff853d04f9090cc854 C:\Users\Pammy\AppData\Local\Google\Chrome\Application\chrome.exe
MD5: 52db04cdedc71a2c3e01bf962839e629 C:\Users\Pammy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.97_0\npqscan.dll
MD5: b226054bfa3d3a1920f7b95e54f3e87d C:\Users\Pammy\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
MD5: 183ff025d09f1f860f2b3bb17d1fc421 C:\Users\Pammy\AppData\Local\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll
MD5: d94c362e750f8c283bf52537d3df28b5 C:\Users\Pammy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
MD5: 09d1876816a0888dd7fc6abf1df19c51 C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\player@portalarium.com\plugins\NPPortalariumPlayer.dll
MD5: 78d4896db266107319ce6ff7d5da9727 C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll
MD5: 34c084b321ea0308c58eed1cf6b5fb02 C:\Users\Pammy\AppData\Roaming\Mozilla\Firefox\Profiles\uzjwy4vh.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
MD5: 368b2bee3f88bfb883d2c74a258de6f6 C:\Windows\AppPatch\AcLayers.DLL
MD5: a8c362018efc87beb013ee28f29c0863 C:\Windows\ehome\ehRecvr.exe
MD5: 8b88ebbb05a0e56b7dcc708498c02b3e C:\Windows\explorer.exe
MD5: c521d7eb6497bb1af6afa89e322fb43c C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
MD5: f476ec40033cdb91efbe73eb99b8362d C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
MD5: 2c49b175aee1d4364b91b531417fe583 C:\Windows\servicing\TrustedInstaller.exe
MD5: 9a39a2a5f443a756c568c6ed5748afe4 C:\Windows\System32\Actioncenter.dll
MD5: d2958325c1ae1ae37a83334c6229e3bc C:\Windows\system32\actxprxy.dll
MD5: 95e2376b3323f062eb562b8586d0f14a C:\Windows\system32\ADVAPI32.dll
MD5: 863f793d15b4026b1a5fdeca873d4d84 C:\Windows\system32\apphelp.dll
MD5: fb1959012294d6ad43e5304df65e3c26 C:\Windows\System32\appinfo.dll
MD5: 088cf5b6380fb9002f2a4246f812225d C:\Windows\system32\asycfilt.dll
MD5: b19505648f033393e907e2e419fde8b3 C:\Windows\system32\atiesrxx.exe
MD5: c940f2f5c60b3727c5f18840735b229c C:\Windows\system32\AUDIOSES.DLL
MD5: ce3b4e731638d2ef62fcb419be0d39f0 C:\Windows\System32\Audiosrv.dll
MD5: cdd35c1ce1ebfe80c055691cdc8df443 C:\Windows\system32\authui.dll
MD5: 6e30d02aac9cac84f421622e3a2f6178 C:\Windows\System32\AxInstSV.dll
MD5: 67c1b58706b47eeba4e117ac197289e6 C:\Windows\system32\BatMeter.dll
MD5: 1e2bac209d184bb851e1a187d8a29136 C:\Windows\System32\bfe.dll
MD5: 6e11f33d14d020f58d5e02e4d67dfa19 C:\Windows\System32\browser.dll
MD5: e3d5e244807ad655787fcd25477cc1bc C:\Windows\System32\bthprops.cpl
MD5: 775c41c2f2ef3dd150a7444b95e631d0 C:\Windows\system32\Bubbles.scr
MD5: 7a6986dd659b96398a11af5173892715 C:\Windows\system32\Cabinet.dll
MD5: 319c6b309773d063541d01df8ac6f55f C:\Windows\System32\certprop.dll
MD5: 3ffaea12666e565ff51bf2fca674f543 C:\Windows\system32\CFGMGR32.dll
MD5: ad7b9c14083b52bc532fba5948342b98 C:\Windows\system32\cmd.exe
MD5: d1de1eafde97be41cf6585027ff3e732 C:\Windows\system32\COMDLG32.dll
MD5: 4e5fe39c1076d115ec8bfcfe14d75b80 C:\Windows\system32\credssp.dll
MD5: 454e292861a4ef1d72f43f42bbaf6917 C:\Windows\system32\CRYPT32.dll
MD5: a585bebf7d054bd9618eda0922d5484a C:\Windows\system32\cryptsvc.dll
MD5: 28ca821606669bb9215ce010767720fa C:\Windows\system32\CRYPTUI.dll
MD5: 465bea35f7ed4a4a57686dea7ea10f47 C:\Windows\system32\CSCAPI.dll
MD5: 57a51217581614de07f30e34d6bb4993 C:\Windows\System32\CSCDLL.dll
MD5: 15f93b37f6801943360d9eb42485d5d3 C:\Windows\System32\cscsvc.dll
MD5: 3ec541c196de18ed9a0d0ac82a694d4c C:\Windows\System32\cscui.dll
MD5: 35cede6439ff0d8903223a0817ffe46c C:\Windows\system32\d2d1.dll
MD5: 2de90400a63818fa38c4c5c9adb166bf C:\Windows\system32\d3d10_1.dll
MD5: 9c36a3ca80f9b204c670336d344f5df8 C:\Windows\system32\d3d10_1core.dll
MD5: 78b7a3bda25c90daa50d36a56a8d1351 C:\Windows\system32\D3D10Warp.dll
MD5: 33d933951e1dd39ba9a973ca5651bc90 C:\Windows\system32\d3d11.dll
MD5: 6ef5f3f18413c367195f06e503ab86a6 C:\Windows\system32\d3d9.dll
MD5: e9e01eb683c132f7fa27cd607b8a2b63 C:\Windows\system32\dhcpcore.dll
MD5: b40420876b9288e0a1c8cca8a84e5dc9 C:\Windows\system32\DNSAPI.dll
MD5: 33ef4861f19a0736b11314aad9ae28d0 C:\Windows\System32\dnsrslvr.dll
MD5: 366ba8fb4b7bb7435e3b9eacb3843f67 C:\Windows\System32\dot3svc.dll
MD5: 8ec04ca86f1d68da9e11952eb85973d6 C:\Windows\system32\dps.dll
MD5: 1b133875b8aa8ac48969bd3458afe9f5 C:\Windows\system32\drivers\1394ohci.sys
MD5: cea80c80bed809aa0da6febc04733349 C:\Windows\system32\drivers\ACPI.sys
MD5: 1efbc664abff416d1d07db115dcb264f C:\Windows\system32\drivers\acpipmi.sys
MD5: 9ebbba55060f786f0fcaa3893bfa2806 C:\Windows\system32\drivers\afd.sys
MD5: d320bf87125326f996d4904fe24300fc C:\Windows\system32\drivers\amdsata.sys
MD5: 46387fb17b086d16dea267d5be23a2f2 C:\Windows\system32\drivers\amdxata.sys
MD5: aea177f783e20150ace5383ee368da19 C:\Windows\system32\drivers\appid.sys
MD5: 47b879406246ffdced59e18d331a0e7d C:\Windows\system32\DRIVERS\avgntflt.sys
MD5: 5fedef54757b34fb611b9ec8fb399364 C:\Windows\system32\DRIVERS\avipbb.sys
MD5: 8f2da3028d5fcbd1a060a3de64cd6506 C:\Windows\system32\DRIVERS\bowser.sys
MD5: be167ed0fdb9c1fa1133953c18d5a6c9 C:\Windows\system32\drivers\cdrom.sys
MD5: cbe8c58a8579cfe5fccf809e6f114e89 C:\Windows\system32\drivers\CompositeBus.sys
MD5: 3c2177a897b4ca2788c6fb0c3fd81d4b C:\Windows\system32\drivers\csc.sys
MD5: f024449c97ec1e464aaffda18593db88 C:\Windows\System32\Drivers\dfsc.sys
MD5: 23f5d28378a160352ba8f817bd8c71cb C:\Windows\System32\drivers\dxgkrnl.sys
MD5: e98a64c7f106740a38fb2b78197816f8 C:\Windows\system32\DRIVERS\ewusbdev.sys
MD5: 0b3957226ec94b1ecb7b9348bb535a23 C:\Windows\system32\DRIVERS\ewusbmdm.sys
MD5: f901126c10ac7ce9eccc222b74bfa5c6 C:\Windows\system32\DRIVERS\ewusbnet.sys
MD5: d909075fa72c090f27aa926c32cb4612 C:\Windows\system32\DRIVERS\fssfltr.sys
MD5: 8a73e79089b282100b9393b644cb853b C:\Windows\System32\DRIVERS\fvevol.sys
MD5: 9036377b8a6c15dc2eec53e489d159b5 C:\Windows\system32\drivers\HDAudBus.sys
MD5: a5ef29d5315111c80a5c1abad14c8972 C:\Windows\system32\drivers\HdAudio.sys
MD5: 10c19f8290891af023eaec0832e1eb4d C:\Windows\system32\drivers\hidusb.sys
MD5: 871917b07a141bff43d76d8844d48106 C:\Windows\system32\drivers\HTTP.sys
MD5: 0c4e035c7f105f1299258c90886c64c5 C:\Windows\System32\drivers\hwpolicy.sys
MD5: 5cd5f9a5444e6cdcb0ac89bd62d8b76e C:\Windows\system32\drivers\iaStorV.sys
MD5: 4bd7134618c1d2a27466a099062547bf C:\Windows\system32\drivers\IPMIDrv.sys
MD5: 9e3ced91863e6ee98c24794d05e27a71 C:\Windows\system32\drivers\kbdhid.sys
MD5: 412cea1aa78cc02a447f5c9e62b32ff1 C:\Windows\System32\Drivers\ksecdd.sys
MD5: 3d2c13377763eeac0ca6fb46f57217ed C:\Windows\system32\drivers\mbam.sys
MD5: fc8771f45ecccfd89684e38842539b9b C:\Windows\System32\drivers\mountmgr.sys
MD5: 2d699fb6e89ce0d8da14ecc03b3edfe0 C:\Windows\system32\drivers\mpio.sys
MD5: ceb46ab7c01c9f825f8cc6babc18166a C:\Windows\system32\drivers\mrxdav.sys
MD5: 5d16c921e3671636c0eba3bbaac5fd25 C:\Windows\system32\DRIVERS\mrxsmb.sys
MD5: a70c828a93cce4c11617f6249f4d87fc C:\Windows\system32\DRIVERS\mrxsmb10.sys
MD5: b81f204d146000be76651a50670a5e9e C:\Windows\system32\DRIVERS\mrxsmb20.sys
MD5: 012c5f4e9349e711e11e0f19a8589f0a C:\Windows\system32\drivers\msahci.sys
MD5: 55055f8ad8be27a64c831322a780a228 C:\Windows\system32\drivers\msdsm.sys
MD5: cb7a9abb12b8415bce5d74994c7ba3ae C:\Windows\system32\drivers\msiscsi.sys
MD5: e7c54812a2aaf43316eb6930c1ffa108 C:\Windows\system32\drivers\ndis.sys
MD5: d8a65dafb3eb41cbb622745676fcd072 C:\Windows\system32\DRIVERS\ndisuio.sys
MD5: 38fbe267e7e6983311179230facb1017 C:\Windows\system32\DRIVERS\ndiswan.sys
MD5: 280122ddcf04b378edd1ad54d71c1e54 C:\Windows\System32\DRIVERS\netbt.sys
MD5: b3e25ee28883877076e0e1ff877d02e0 C:\Windows\system32\drivers\nvraid.sys
MD5: 4380e59a170d88c4f1022eff6719a8a4 C:\Windows\system32\drivers\nvstor.sys
MD5: bf8f6af06da75b336f07e23aef97d93b C:\Windows\System32\drivers\partmgr.sys
MD5: fd2041e9ba03db7764b2248f02475079 C:\Windows\system32\DRIVERS\pccsmcfd.sys
MD5: 673e55c3498eb970088e812ea820aa8f C:\Windows\system32\drivers\pci.sys
MD5: d528bc58a489409ba40334ebf96a311b C:\Windows\system32\DRIVERS\rdbss.sys
MD5: 23dae03f29d253ae74c44f99e515f9a1 C:\Windows\System32\DRIVERS\RDPCDD.sys
MD5: b973fcfc50dc1434e1970a146f7e3885 C:\Windows\System32\drivers\rdpdr.sys
MD5: 68a0387f58e226deee23d9715955572a C:\Windows\System32\drivers\rdpvideominiport.sys
MD5: 518395321dc96fe2c9f0e96ac743b656 C:\Windows\System32\drivers\rdyboost.sys
MD5: 05d860da1040f111503ac416ccef2bca C:\Windows\system32\drivers\sbp2port.sys
MD5: 0693b5ec673e34dc147e195779a4dcf6 C:\Windows\System32\DRIVERS\scfilter.sys
MD5: 0328be1c7f1cba23848179f8762e391c C:\Windows\system32\drivers\sdbus.sys
MD5: 6d4ccaedc018f1cf52866bbbaa235982 C:\Windows\system32\drivers\sffp_sd.sys
MD5: e4c2764065d66ea1d2d3ebc28fe99c46 C:\Windows\System32\DRIVERS\srv.sys
MD5: 03f0545bd8d4c77fa0ae1ceedfcc71ab C:\Windows\System32\DRIVERS\srv2.sys
MD5: be6bd660caa6f291ae06a718a4fa8abc C:\Windows\System32\DRIVERS\srvnet.sys
MD5: dcaffd62259e0bdb433dd67b5bb37619 C:\Windows\system32\drivers\storvsc.sys
MD5: 24326784df8f3d5f5bbb9f878ce33c14 C:\Windows\System32\drivers\tcpip.sys
MD5: cca24162e055c3714ce5a88b100c64ed C:\Windows\System32\drivers\tcpipreg.sys
MD5: 1cb91b2bd8f6dd367dfc2ef26fd751b2 C:\Windows\system32\drivers\tdpipe.sys
MD5: 2c10395baa4847f83042813c515cc289 C:\Windows\system32\drivers\tdtcp.sys
MD5: b459575348c20e8121d6039da063c704 C:\Windows\system32\DRIVERS\tdx.sys
MD5: 04dbf4b01ea4bf25a9a3e84affac9b20 C:\Windows\system32\drivers\termdd.sys
MD5: 2c15b4856f929ac7dd144044d8334b54 C:\Windows\system32\DRIVERS\tosporte.sys
MD5: 6750328ab04ae5faf01403a575d66978 C:\Windows\system32\DRIVERS\tosrfbd.sys
MD5: 45a0fd8d566e7c44b2fc340cbd6672d0 C:\Windows\System32\Drivers\tosrfbnp.sys
MD5: c281d231ba7bc7955d39ea9e21374eff C:\Windows\System32\Drivers\tosrfcom.sys
MD5: 5c4103544612e5011ef46301b93d1aa6 C:\Windows\system32\DRIVERS\tosrfec.sys
MD5: 592cd9c8ab08ef02ea53905d30fb157e C:\Windows\system32\DRIVERS\Tosrfhid.sys
MD5: 0f3fd4f55175caeddce9efd6c5ca45d3 C:\Windows\system32\DRIVERS\tosrfnds.sys
MD5: d44eebdbdd24f813c09153034dae9e84 C:\Windows\system32\drivers\tosrfsnd.sys
MD5: c4245835d4fac0494ed616f3bfe9ee0a C:\Windows\system32\DRIVERS\tosrfusb.sys
MD5: 254bb140eee3c59d6114c1a86b636877 C:\Windows\System32\DRIVERS\tssecsrv.sys
MD5: fd1d6c73e6333be727cbcc6054247654 C:\Windows\system32\drivers\tsusbflt.sys
MD5: b2fa25d9b17a68bb93d58b0556e8c90d C:\Windows\system32\DRIVERS\tunnel.sys
MD5: 792a8b80f8188aba4b2be271583f3e46 C:\Windows\system32\DRIVERS\TVALZ_O.SYS
MD5: ee43346c7e4b5e63e54f927babbb32ff C:\Windows\system32\DRIVERS\udfs.sys
MD5: d295bed4b898f0fd999fcfa9b32b071b C:\Windows\system32\drivers\umbus.sys
MD5: bd9c55d7023c5de374507acc7a14e2ac C:\Windows\system32\DRIVERS\usbccgp.sys
MD5: f92de757e4b7ce9c07c5e65423f3ae3b C:\Windows\system32\DRIVERS\usbehci.sys
MD5: 8dc94aec6a7e644a06135ae7506dc2e9 C:\Windows\system32\DRIVERS\usbhub.sys
MD5: e185d44fac515a18d9deddc23c2cdf44 C:\Windows\system32\drivers\usbohci.sys
MD5: 31181de6190b39fc8007dffd1a48ffd6 C:\Windows\system32\drivers\usbser.sys
MD5: f991ab9cc6b908db552166768176896a C:\Windows\system32\drivers\USBSTOR.SYS
MD5: 68df884cf41cdada664beb01daf67e3d C:\Windows\system32\DRIVERS\usbuhci.sys
MD5: 45f4e7bf43db40a6c6b4d92c76cbc3f2 C:\Windows\System32\Drivers\usbvideo.sys
MD5: 5461686cca2fda57b024547733ab42e3 C:\Windows\system32\drivers\vhdmp.sys
MD5: c2f2911156fdc7817c52829c86da494e C:\Windows\system32\drivers\vmbus.sys
MD5: d4d77455211e204f370d08f4963063ce C:\Windows\system32\drivers\VMBusHID.sys
MD5: 7fa7f2e249a5dcbb7970630e15e1f482 C:\Windows\system32\drivers\vms3cap.sys
MD5: 472af0311073dceceaa8fa18ba2bdf89 C:\Windows\system32\drivers\vmstorfl.sys
MD5: 4c63e00f2f4b5f86ab48a58cd990f212 C:\Windows\system32\drivers\volmgr.sys
MD5: f497f67932c6fa693d7de2780631cfe7 C:\Windows\system32\drivers\volsnap.sys
MD5: 3c3c78515f5ab448b022bdf5b8ffdd2e C:\Windows\system32\DRIVERS\wanarp.sys
MD5: a67e5f9a400f3bd1be3d80613b45f708 C:\Windows\system32\DRIVERS\WinUsb.sys
MD5: e714a1c0354636837e20ccbf00888ee7 C:\Windows\system32\drivers\WudfPf.sys
MD5: 1023ee888c9b47178c5293ed5336ab69 C:\Windows\system32\DRIVERS\WUDFRd.sys
MD5: b07c5b7efdf936ff93d4f540938725be C:\Windows\system32\DRIVERS\yk62x86.sys
MD5: 497e59d9f01c6f247e72222a61835119 C:\Windows\system32\dwmcore.dll
MD5: 754afc50022c95da7c86b7020db78136 C:\Windows\system32\dwmredir.dll
MD5: 0a5c7253183a6f956d10a3a4bbc96288 C:\Windows\system32\DWrite.dll
MD5: 69c85737f4ca5634e7a19b818579d176 C:\Windows\system32\dxdiagn.dll
MD5: 0411b7958c524bb2e91ee1b3035fe321 C:\Windows\system32\dxgi.dll
MD5: addb05c93272a62606599b24730bd645 C:\Windows\system32\dxp.dll
MD5: 4312debdacbe338f0b90e7f08e7672be C:\Windows\System32\Dxtmsft.dll
MD5: ca493a92da9880b6f1a89c3dbd54ba5b C:\Windows\System32\Dxtrans.dll
MD5: e2a17bcc08d92f42e08af6ba2f93aba7 C:\Windows\system32\EXPLORERFRAME.dll
MD5: b3a5ec6b6b6673db7e87c2bcdbddc074 C:\Windows\system32\FntCache.dll
MD5: d0481fb85beedd30a0884be327880f80 C:\Windows\System32\framedynos.dll
MD5: 03a03a453f1aaae0c73aaaf895321c7a C:\Windows\System32\fwpuclnt.dll
MD5: 967ea5b213e9984cbe270205df37755b C:\Windows\system32\fxssvc.exe
MD5: 19bc13711ac403feb830522e4831701b C:\Windows\System32\gameux.dll
MD5: e87f5393f7d8ce2facc4dff703531392 C:\Windows\system32\GDI32.dll
MD5: e897eaf5ed6ba41e081060c9b447a673 C:\Windows\System32\gpsvc.dll
MD5: c7952d0a4c43a965a1741916bb134751 C:\Windows\System32\hgcpl.dll
MD5: 7319102526bd11b45fd66335cf90ca12 C:\Windows\System32\HotStartUserAgent.dll
MD5: 9af36c3c48f82d95b5670d7c29923d8a C:\Windows\system32\ieframe.dll
MD5: 733c7f11b06892f9dc283d4bb34abd25 C:\Windows\system32\iertutil.dll
MD5: f95622f161474511b8d80d6b093aa610 C:\Windows\System32\ikeext.dll
MD5: b2fd31e20b423335fe3273b4bf95813c C:\Windows\system32\imagehlp.dll
MD5: 2d11bc8b460957e62e4420373a0d8bda C:\Windows\system32\imapi2.dll
MD5: 68563ac389f92ee79f1c714288ba1dce C:\Windows\system32\ImgUtil.dll
MD5: 4a8e2f20809cc161107faa94f6cf2685 C:\Windows\system32\IMM32.DLL
MD5: a90dc9abd65db1a8902f361103029952 C:\Windows\system32\IPHLPAPI.DLL
MD5: 4d65a07b795d6674312f879d09aa7663 C:\Windows\System32\iphlpsvc.dll
MD5: 53946b69ba0836bd95b03759530c81ec C:\Windows\System32\ipsecsvc.dll
MD5: 1ddefa440b300cfae8be46049ce90ef4 C:\Windows\system32\jscript.dll
MD5: c92f538f531f26f2e240a8b21420692a C:\Windows\System32\jscript9.dll
MD5: 5553784d774ca845380650e010bbda2c C:\Windows\system32\kernel32.dll
MD5: aa7e805af3f7db2da9ea350423e87dfd C:\Windows\system32\KERNELBASE.dll
MD5: 196b4e3f4cccc24af836ce58facbb699 C:\Windows\system32\kmsvc.dll
MD5: 6658f4404de03d75fe3ba09f7aba6a30 C:\Windows\system32\ListSvc.dll
MD5: 6bb36fe5fab0d213c4c1554a2cba67fc C:\Windows\system32\Macromed\Flash\NPSWF32.dll
MD5: bfb9ee8ee977efe85d1a3105abef6dd1 C:\Windows\system32\Mcx2Svc.dll
MD5: 243974ec02f7ae49e4179c54624143ab C:\Windows\system32\MMDevAPI.DLL
MD5: 9835584e999d25004e1ee8e5f3e3b881 C:\Windows\system32\mpssvc.dll
MD5: 938f39b50bafe13d6f58c7790682c010 C:\Windows\system32\MSASN1.dll
MD5: 7f8678c59f188528d60104e697c2361e C:\Windows\system32\mscms.dll
MD5: 7069aab8536f29ed7323140973a2894b C:\Windows\system32\msdmo.dll
MD5: 3a16ea01fcfaab40882db5bfee632322 C:\Windows\system32\MsftEdit.dll
MD5: 3f63f95c998f7e1af409bc74e83d45e5 C:\Windows\System32\mshtml.dll
MD5: 0ce4d3bd306da6d1f6f233c403f5b667 C:\Windows\system32\msi.dll
MD5: eee470f2a771fc0b543bdeef74fceca0 C:\Windows\system32\msiexec.exe
MD5: 35aae2e841aa1a949775168e119482c9 C:\Windows\system32\msls31.dll
MD5: 56ceed370508f69a1ba04939bd1badda C:\Windows\system32\MSUTB.dll
MD5: 8999b8631c7fd9f7f9ec3cafd953ba24 C:\Windows\system32\mswsock.dll
MD5: 269d867585cda04d3972a39f3694e7df C:\Windows\System32\msxml6.dll
MD5: 8b57a1ad493653bb57f281fe75dd175b C:\Windows\System32\NaturalLanguage6.dll
MD5: 8ce1a6d16b9077e91e192499eb611c5f C:\Windows\system32\NETAPI32.dll
MD5: eab975db4c2805927fe5bd047d05c9aa C:\Windows\System32\netshell.dll
MD5: 20b3934db73eaba2b49b7177873cb81f C:\Windows\system32\netutils.dll
MD5: 104a1070e90f1c530328e69b49718841 C:\Windows\System32\nlaapi.dll
MD5: ed60c95c805dbaee92c90c3ab930085a C:\Windows\SYSTEM32\ntdll.dll
MD5: eb77db354791a5932ca559b6f6374e95 C:\Windows\system32\ntshrui.dll
MD5: 928cf7268086631f54c3d8e17238c6dd C:\Windows\system32\ole32.dll
MD5: 1cbaedc5448cd922dcf82283383ad68b C:\Windows\system32\OLEAUT32.dll
MD5: 487f44b08efeaf5ad087878357b9403d C:\Windows\system32\pdh.dll
MD5: 414bba67a3ded1d28437eb66aeb8a720 C:\Windows\system32\pla.dll
MD5: 3d6f22551d422f97aacb0bb927e4c846 C:\Windows\System32\pnidui.dll
MD5: e98278865e8daba21cfe5fe4be34210a C:\Windows\system32\PortableDeviceApi.dll
MD5: c8333f1f77a1b2e25f2202e892caf634 C:\Windows\system32\prnfldr.dll
MD5: 43ca4ccc22d52fb58e8988f0198851d0 C:\Windows\system32\profsvc.dll
MD5: 12c45e3cb6d65f73209549e2d02eca7a C:\Windows\system32\PROPSYS.dll
MD5: dbc02d918fff1cad628acbe0c0eaa8e8 C:\Windows\System32\provsvc.dll
MD5: 02530b0b7e048dd5ac8d52daeacaeb2b C:\Windows\System32\QAgent.dll
MD5: 61d57a5d7c6d9afe10e77dae6e1b445e C:\Windows\system32\qagentRT.dll
MD5: e585445d5021971fae10393f0f1c3961 C:\Windows\system32\qmgr.dll
MD5: b4d0d2f098c7a68385560df4551551ca C:\Windows\system32\quartz.dll
MD5: bd626ef05967d14c772b8096292731a3 C:\Windows\System32\QUtil.dll
MD5: cb9e04dc05eacf5b9a36ca276d475006 C:\Windows\System32\rasmans.dll
MD5: 102cf6879887bbe846a00c459e6d4abc C:\Windows\system32\RICHED20.dll
MD5: 6400774e903729add0a62a24a334ee56 C:\Windows\system32\RPCRT4.dll
MD5: 5997d769cdb108390dcfaebf442bf816 C:\Windows\system32\RpcRtRemote.dll
MD5: 7660f01d3b38aca1747e397d21d790af C:\Windows\system32\rpcss.dll
MD5: 0915c4db6dbc3bb9e11b7ecbbe4b7159 C:\Windows\system32\rtutils.dll
MD5: 68ecca523ed760aafc03c5d587569859 C:\Windows\system32\samcli.dll
MD5: 135f7ac9be35ab1df727faf2e60e92f8 C:\Windows\system32\schannel.DLL
MD5: a04bb13f8a72f8b6e8b4071723e4e336 C:\Windows\system32\schedsvc.dll
MD5: 08236c4bce5edd0a0318a438af28e0f7 C:\Windows\System32\SDRSVC.dll
MD5: 6581b52e133cc6d00661c58968c7e212 C:\Windows\system32\SearchFolder.dll
MD5: a8ce0c7f1d37e0b8082608a148b6b976 C:\Windows\system32\Secur32.dll
MD5: 4ae380f39a0032eab7dd953030b26d28 C:\Windows\system32\sessenv.dll
MD5: 10fb16b50affda6d44588f3c445dc273 C:\Windows\system32\SETUPAPI.dll
MD5: be247ae996a9fde007a27b51413a6c79 C:\Windows\System32\shdocvw.dll
MD5: 16ab4bd2acc52109f43739bf0e89e18f C:\Windows\system32\SHELL32.dll
MD5: 8cc3c111d653e96f3ea1590891491d71 C:\Windows\system32\SHLWAPI.dll
MD5: 414da952a35bf5d50192e28263b40577 C:\Windows\System32\shsvcs.dll
MD5: 2cfa4569350b7f84f815e9ec34e85766 C:\Windows\system32\SndVolSSO.DLL
MD5: 866a43013535dc8587c258e43579c764 C:\Windows\System32\spoolsv.exe
MD5: cf87a1de791347e75b98885214ced2b8 C:\Windows\system32\sppsvc.exe
MD5: b0180b20b065d89232a78a40fe56eaa6 C:\Windows\system32\sppuinotify.dll
MD5: 674b0c0f6a448eb185caab9c51d44032 C:\Windows\System32\srchadmin.dll
MD5: 5ccdcd40e732d54e0f7451ac66ac1c87 C:\Windows\system32\srvcli.dll
MD5: d64af876d53eca3668bb97b51b4e70ab C:\Windows\System32\srvsvc.dll
MD5: 331534632d1da3377440493848e4a70e C:\Windows\system32\SspiCli.dll
MD5: 912649a1b3f9e6acb3899fbdaba2ed5f C:\Windows\system32\stobject.dll
MD5: 6a1e8deb746912df47cf651e138401d7 C:\Windows\System32\StructuredQuery.dll
MD5: 919001d2bb17df06ca3f8ac16ad039f6 C:\Windows\system32\SXS.DLL
MD5: 2ddea2c345da5bc589efd398f220db0e C:\Windows\System32\SyncCenter.dll
MD5: 36650d618ca34c9d357dfd3d89b2c56f C:\Windows\system32\sysmain.dll
MD5: 763fecdc3d30c815fe72dd57936c6cd1 C:\Windows\System32\TabSvc.dll
MD5: 613bf4820361543956909043a265c6ac C:\Windows\System32\tapisrv.dll
MD5: 7fa8ba5a780e4757964ac9d4238302b9 C:\Windows\System32\taskhost.exe
MD5: 544eff88ac6c85df5a4d6f18dfe08cfc C:\Windows\system32\taskschd.dll
MD5: 382c804c92811be57829d8e550a900e2 C:\Windows\System32\termsrv.dll
MD5: 672d7c5080acb003343006405da2e621 C:\Windows\system32\thumbcache.dll
MD5: 83c9840cf87a0ca55526327801716d27 C:\Windows\system32\timedate.cpl
MD5: 3cd99e5b2487a4018aacbceb19ee65d0 C:\Windows\system32\tquery.dll
MD5: 92dc6e68d2c856c5c2f21ae9e22112b8 C:\Windows\system32\umpnpmgr.dll
MD5: f87d30e72e03d579a5199ccb3831d6ea C:\Windows\system32\umpo.dll
MD5: 409994a8eaceee4e328749c0353527a0 C:\Windows\System32\umrdp.dll
MD5: df6de2f5afb9fa1cfa02081ef9b3e7e8 C:\Windows\system32\urlmon.dll
MD5: f1dd3acaee5e6b4bbc69bc6df75cef66 C:\Windows\system32\USER32.dll
MD5: d15618a0ff8dbc2c5bf3726bacc75a0b C:\Windows\system32\USERENV.dll
MD5: 61ac3efdfacfdd3f0f11dd4fd4044223 c:\windows\system32\userinit.exe
MD5: 804aaafebb3ad5f49334dd906bcb1de5 C:\Windows\system32\USP10.dll
MD5: c3cd30495687c2a2f66a65ca6fd89be9 C:\Windows\System32\vds.exe
MD5: 209a3b1901b83aeb8527ed211cce9e4c C:\Windows\system32\vssvc.exe
MD5: cfc7d8289d2b5f3cf8d16e2db7f93d4a C:\Windows\system32\wbem\fastprox.dll
MD5: 704314fd398c81d5f342caa5df7b7f21 C:\Windows\system32\wbemcomn.dll
MD5: 691e3285e53dca558e1a84667f13e15a C:\Windows\system32\wbengine.exe
MD5: 34eee0dfaadb4f691d6d5308a51315dc C:\Windows\System32\wcncsvc.dll
MD5: d205c24a9d069049fe2df2a1b38726a7 C:\Windows\system32\wdmaud.drv
MD5: 5193de33f3284c447e0d31dafbf92570 c:\windows\system32\webcheck.dll
MD5: a9d880f97530d5b8fee278923349929d C:\Windows\System32\webclnt.dll
MD5: 02c61d8ad469417f5508225c75de3236 C:\Windows\system32\webio.dll
MD5: 590d5c506044fe02ff7643e32ff9bdac C:\Windows\System32\wer.dll
MD5: 1869bd251211fb6275067372a45682d6 C:\Windows\System32\werconcpl.dll
MD5: e1fb3706030fb4578a0d72c2fc3689e4 C:\Windows\System32\wiaservc.dll
MD5: 1db71a41daee6b3f8cd0dda8209fa2d5 C:\Windows\system32\windowscodecs.dll
MD5: ca9f7888b524d8100b977c81f44c3234 C:\Windows\system32\WINHTTP.dll
MD5: a1236375b74ea63c75657d564890c436 C:\Windows\system32\WININET.dll
MD5: d5aefad57c08349a4393d987df7c715d C:\Windows\system32\WINMM.dll
MD5: 9e4b0e7472b4ceba9e17f440b8cb0ab8 C:\Windows\system32\WINSPOOL.DRV
MD5: 418e881201583a3039d81f43e39e6c78 C:\Windows\system32\WINSTA.dll
MD5: 2d0d2da87bea7144f2a17f19d0d17e4c C:\Windows\system32\WINTRUST.dll
MD5: e5a4a1326a02f8e7b59e6c3270ce7202 C:\Windows\system32\wkscli.dll
MD5: 58405e4f68ba8e4057c6e914f326aba2 C:\Windows\System32\wkssvc.dll
MD5: a8bb45f9ecad993461e0fef8e2a99152 C:\Windows\system32\WLDAP32.dll
MD5: aa53356d60af47eacc85bc617a4f3f66 C:\Windows\system32\wpdbusenum.dll
MD5: 735263da17bf5baf9ccd483843bf9d5a C:\Windows\system32\wpdshserviceobj.dll
MD5: 7ff15a4f092cd4a96055ba69f903e3e9 C:\Windows\system32\WS2_32.dll
MD5: a8cdf3768604ff95b54669e20053d569 C:\Windows\System32\WSCAPI.dll
MD5: 7fd5532c142db6c9cc47aa4dcf71fdec C:\Windows\System32\wscui.cpl
MD5: 1b91cd34ea3a90ab6a4ef0550174f4cc C:\Windows\system32\WsmSvc.dll
MD5: 6a6b2ee4565a178035be2a4ff6f2c968 C:\Windows\system32\WTSAPI32.dll
MD5: 3026418a50c5b4761befa632cedb7406 C:\Windows\system32\wuaueng.dll
MD5: 8d1e1e529a2c9e9b6a85b55a345f7629 C:\Windows\System32\WUDFSvc.dll
MD5: 0b3595a4ff0b36d68e5fc67fd7d70fdc C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCP80.dll
MD5: c9564cf4976e7e96b4052737aa2492b4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll
MD5: 4c39358ebdd2ffcd9132a30e1ec31e16 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll
MD5: cdbe9690cf2b8409facad94fac9479c9 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
MD5: ca6ade4f7761bb15b3325356dc3b82bb C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
MD5: fbfca1a574d47ee575448b719cbbf2e4 C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\MFC90ENU.DLL
MD5: bdac1aa64495d0f7e1ff810ebbf1f018 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll
MD5: 352b3dc62a0d259a82a052238425c872 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
MD5: 0029eba325f2fc9b6ba46bee33f32a09 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll

No file uploaded.

Scan finished - communication took 12 sec
Total traffic - 0.04 MB sent, 1.44 KB recvd
Scanned 785 files and modules - 40 seconds

==============================================================================

broni · 2011/06/27

Very well...

We're pretty much done in this forum....

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.

PamMac · 2011/06/27

Sorry, looks like I didn't hit post reply when I put the last log on.
As nothing as changed with start-up since my original post, do I take this back to the Windows 7 Forum?
Thank you so much for your time & patience Broni

broni · 2011/06/27

You're very welcome

Yes, please go back to "7" forum.

But, make sure you complete all final steps first.

PamMac · 2011/06/27

All steps finished & PSI is running now. How shall I mark this before moving back to 7, as the original problem isn't solved?
Thanks again!

broni · 2011/06/27

I already marked this topic as inactive.

Log in or Sign up

Inactive Freezing or turning off at start-up

PamMac Inactive Thread Starter

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Inactive Freezing or turning off at start-up

PamMac Inactive Thread Starter

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

PamMac Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches